fix: 2-year server cert with renewal warning and rotation runbook #16

New issue

Closed

opened 2026-07-03 12:52:01 +00:00 by a73x · 1 comment

a73x commented

2026-07-03 12:52:01 +00:00

(Migrated from git.a73x.sh)

[claude 2026-07-03] Fixes d51e260f. GenerateServerCert validity 10y -> 2y (pin ignores expiry, so validity only widens the forgery window if server.key leaks); transport.CertRenewalDue(certPEM, now) reports due within 90d of NotAfter (unparseable cert = due, fail-loud); eitri-server warns at startup when due; docs/cert-rotation.md documents the ceremony (rotate = new cert + re-enroll agents via join blobs; running VMs untouched; expired cert never breaks the fleet). TDD: validity test watched fail against 10y; CertRenewalDue table watched fail at build then behaviorally green. make ci green.

Migrated from git-collab patche 5de01ffbf48e952111d60d27342c79c6ed00712b.

Original author: a73x dev@a73x.sh.

Fixes git-collab issue d51e260f

Historical merged patch. The original head and merge commits were not recorded. Forgejo cannot display a pull request without a head commit, so this record is preserved as a closed issue. The original diff is unavailable; no commit was guessed.

Original branches: fix/cert-rotation → main.

[claude 2026-07-03] Fixes d51e260f. GenerateServerCert validity 10y -> 2y (pin ignores expiry, so validity only widens the forgery window if server.key leaks); transport.CertRenewalDue(certPEM, now) reports due within 90d of NotAfter (unparseable cert = due, fail-loud); eitri-server warns at startup when due; docs/cert-rotation.md documents the ceremony (rotate = new cert + re-enroll agents via join blobs; running VMs untouched; expired cert never breaks the fleet). TDD: validity test watched fail against 10y; CertRenewalDue table watched fail at build then behaviorally green. make ci green. --- Migrated from git-collab patche `5de01ffbf48e952111d60d27342c79c6ed00712b`. Original author: a73x <dev@a73x.sh>. Fixes git-collab issue `d51e260f` **Historical merged patch.** The original head and merge commits were not recorded. Forgejo cannot display a pull request without a head commit, so this record is preserved as a closed issue. The original diff is unavailable; no commit was guessed. Original branches: `fix/cert-rotation` → `main`.

a73x commented

2026-07-03 12:57:24 +00:00

(Migrated from git.a73x.sh)

Original review: comment (revision not recorded)

[claude 2026-07-03] Fresh-context reviewer: approve-with-fixes. Verified the central claim true end-to-end (pin ignores expiry: InsecureSkipVerify + fingerprint-only VerifyConnection; nothing server-side validates NotAfter; store regenerates only on file-read failure). All four pre-merge items applied in follow-up commit: gofmt; startup fingerprint log (makes runbook step 3 true); daily renewal re-check (long-lived daemons); runbook step 4 agent-restart requirement (the real operational footgun — join only rewrites disk identity). Minors applied: NotNil guard, garbage-DER test case, distinct corrupt-cert message. make ci green. Merging per session goal.

**Original review: comment** (revision not recorded) [claude 2026-07-03] Fresh-context reviewer: approve-with-fixes. Verified the central claim true end-to-end (pin ignores expiry: InsecureSkipVerify + fingerprint-only VerifyConnection; nothing server-side validates NotAfter; store regenerates only on file-read failure). All four pre-merge items applied in follow-up commit: gofmt; startup fingerprint log (makes runbook step 3 true); daily renewal re-check (long-lived daemons); runbook step 4 agent-restart requirement (the real operational footgun — join only rewrites disk identity). Minors applied: NotNil guard, garbage-DER test case, distinct corrupt-cert message. make ci green. Merging per session goal.